Hacking the Cubes
Serial connection to the cube
Laurent has a serial cable that can be used with the Cubes. connect a computer to the Cube (the serial connector is just on top of the power plug). The terminal emulator should be configured for 115200,n,8,1 communications without parity check. When booting, the bootloader (YAMON) will display its welcome message.
YAMON ROM Monitor, Revision 02.17mtx1. Copyright (c) 1999-2000 MIPS Technologies, Inc. - All Rights Reserved. For a list of available commands, type 'help'. Compilation time = May 19 2005 14:21:19 MAC address = 00.0e.56.00.63.16 Processor Company ID = 0x03 Processor ID/revision = 0x02 / 0x02 Endianness = Little CPU = 396 MHz Flash memory size = 32 MByte SDRAM size = 64 MByte First free SDRAM address = 0x8008c8f4 MTX-1 Watchdog support Environment variable 'start' exists. After 4.0 seconds it will be interpreted as a YAMON command and executed. Press Ctrl-C to bypass this. General Purpuse Button is Released
If Ctrl-C is hit timely, YAMON will drop to an interactive console where, for example, the environment can be inspected.
YAMON> set MAC (R/W) 0 bootfile (R/W) bootprot (R/W) tftp bootserport (R/W) tty0 bootserver (R/W) 192.168.226.1 cubeID (USER) 1784 ethaddr (R/W) 00.0e.56.00.63.16 gateway (R/W) 192.168.226.1 ipaddr (R/W) 192.168.226.2 memsize (RO) 0x04000000 modetty0 (RO) 115200,n,8,1,none modetty1 (RO) 115200,n,8,1,none prompt (R/W) YAMON serial (USER) 051291209 start (R/W) go 0xbfd00000 root=/dev/mtdblock/0 subnetmask (R/W) 255.255.255.0
A quick example of an environment redefinition after an erase -e, assuming the TFTP server is vision.inria.fr, and the Cube has ID 1784 (imara-cube-1784.inria.fr).
YAMON> set bootprot tftp YAMON> set bootserver 128.93.7.99 YAMON> set ethaddr 00.0e.56.00.63.16 YAMON> set gateway 128.93.1.100 YAMON> set ipaddr 128.93.7.156 YAMON> set subnetmask 255.255.192.0
Installing images via TFTP
A TFTP server should first be setup on a machine (see this other page for some hints), preferably on the same ethernet segment as the Cube to hack is. All the necessary images (kernels, filsystems, combined images,…) in /tftpboot (or wherever the TFTP daemon looks for them), and given the appropriate reading rights.
Once the Cube is powered, on should go to the YAMON console. The ethaddr and ipaddr may need to be modified to valid values.
YAMON> set ethaddr 00.0e.56.00.63.16 YAMON> set ipaddr 128.93.7.11
Before downloading and writing a new image, the flash should be erased. Depending on what image will be reflashed, the addresses and ranges (resp. 0xbfd00000/0x140000 for a 2.6 kernel or 0xbfd00000/0xf0000 for an original 2.4 kernel from 4G) should be specified, or -s (for a filesystem image). When installing a combined image, both regions must be erased first.
YAMON> erase ADDRESS RANGE what... The following area will be erased: Start address = ADDRESS Size = RANGE Confirm ? (y/n) y Erasing...Done
The “Start address” and “Size” as reported by YAMON before starting the erase process my be different from what has been entered, this is because they have been rounded off to match the memory's boundaries.
The image can finally be retrieved from the TFTP server.
YAMON>load tftp://TFTP_IP_ADDR/IMAGE.srec About to load tftp://TFTP_IP_ADDR/IMAGE.srec Press Ctrl-C to break ................[...]................... Start = ADDRESS, range = (ADDRESS,ADDRESS+IMAGE_SIZE), format = SREC
If the bootprot and bootserver environment variables have been set, it is possible to load an image more easily. The bootfile can also be specified.
YAMON> bootprot tftp YAMON> bootserver TFTP_IP_ADDR YAMON> load /IMAGE.srec About to load tftp://TFTP_IP_ADDR/IMAGE.srec Press Ctrl-C to break ................[...]...................
Once written (be it to RAM or to flash), the image can be started, with optional arguments (e.g. as specified in the $start environment variable).
YAMON> go ADDRESS
Complete example: Reflashing the original combined image
A full featured example using the YAMON console.
YAMON> erase 0xbfd00000 0xf0000 what... The following area will be erased: Start address = 0x1fd00000 Size = 0x00100000 Confirm ? (y/n) y Erasing...Done YAMON> YAMON> erase -s Erasing...system... Done YAMON> load /combined.srec About to load tftp://128.93.7.99/combined.srec Press Ctrl-C to break ................[...]................... YAMON> set start "go 0xbfd00000 root=/dev/mtdblock/0" YAMON> $start loaded at: BFD00000 BFDE7000 relocated to: 81000000 810E7000 zimage at: 810063D0 810E6669 Uncompressing Linux at load address 80100000 Now booting the kernel [...]
Note: on some (most?) of the Cubes, the system may reset itself after an erase -s. It is unsure whether this behavior is desired or not, nor whether the flash space is correctly cleaned up. If the subsequent flashing of the image fails, it is very possible that this is due to the flash not having been completely cleaned up.
The simplest way to do so, though, would be to use a modified install-image script (originally from meshcube.org) using imara-serv.inria.fr's mirror to reinstall the initial system.
